The PPA stands 
for professional 
publishers 


PPA Submission to the ICO Data Protection and Journalism Consultation 
Call for Evidence 
Written Evidence Submitted by the Professional Publishers Association (PPA) 
24" May 2019 


Sent by email to journalismcode@ico.org.uk 


About Us 


The Professional Publishers Association (PPA) stands for professional publishers, representing 
magazine media and business information publishers in consumer, customer and business sectors in 
the UK. Our membership comprises over 260 companies, publishing around 2,500 consumer 
magazine titles and 4,500 business-to-business publications as well as data and information 
products. The PPA's membership incorporates the UK’s largest publishing houses, including 
Ascential, Bauer Media Group, Centaur, Condé Nast, Dennis Publishing, The Economist, Haymarket 
Media Group, Hearst UK, Immediate Media, TI Media, and William Reed Business Media as well as 
many smaller independent publishers. A full list of members can be found here: 
www.ppa.co.uk/Resources/Members 


Executive Summary 


PPA welcomes the opportunity to submit evidence to the Information Commissioner’s review of the 
data protection and journalism code of practice, which seeks to update existing guidelines to reflect 
the present legislative landscape with regard to data protection. 


Whilst we are aware the system in place has helped to balance data protection with the journalistic 
requirement of access to information, this presents a valuable opportunity to improve the existing 
code and make it more effective. 


The collection of data and information about people is at the heart of journalism and the 
development of public interest news. Therefore, protecting freedom of expression and free press 
should be at the forefront of ICO discussions on reform. Crucially, the ICO needs to continue to 
recognise journalistic exemptions when interpreting data protection law and using its regulatory 
powers. 


Failure to strike a suitable balance between freedom of expression and information and the data 
protection rights of individuals could having damaging repercussions for journalists and the 
publishing industry, as well as their capacity to act as the fourth estate, providing a social good by 
producing public interest news. 


Magazine publishers and editors strive to adhere to the ICO guide on data protection, as well as 
other regulatory bodies such as IPSO. Respecting individuals’ rights and treating their personal data 
within the law is vital to maintaining the public’s trust and is therefore a fundamental principle 
respected when acquiring information to generate journalistic content. 
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Furthermore, the processing of data and information for the purposes of journalism is not solely 
carried out by magazine publishers and other media organisations. Hence, the concept of 
‘journalism’ is required to be interpreted broadly to ensure proper protection for the special 
purposes and may be carried out by citizen journalists, bloggers, charitable organisations, and 
whistle-blowers, as well as organisations who wish to disclose personal data to the media. The 
journalistic exemption needs to remain broad in scope to incorporate the work of the types of 
stakeholder listed here. 


The PPA has seen and supports the consultation submission by the Media Lawyers Association 
(MLA), and its recommendation that ICO Code reform does not adopt a more prescriptive, confusing 
set of principles. Simultaneously, we support the safeguarding of the recognition that there is an 
inherent public interest in journalism. 


As the new Code develops, we would welcome further involvement in the drafting process. 


Consultation Questions 


Q1 We are considering using our current guidance "Data protection and journalism: a guide for the 
media” as the basis on which we will build the new journalism code. Do you agree or disagree with 
this approach? 


Agree B 
Disagree C] 


Q2 If you disagree, please explain why? 


N/A 


Q3 "Data protection and journalism: a guide for the media” is split into three sections: 


“Practical guidance” aimed at anyone working in the journalism sector; 
“Technical guidance” aimed at data protection practitioners within media organisations; and 
“Disputes”, aimed at senior editors and staff responsible for data protection compliance. 


Do you think we should retain this structure for the code? 
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Q4 If no, do you have any suggestions about how we should structure the code? 


N/A 


Q5 Do you think the ICO’s existing guidance for journalists addresses the main areas where data 
protection issues commonly arise? 


Agree ee 
Disagree x 


Q6 If no, what additional areas would you like to see covered? 


The PPA welcomes the recognition of the fundamental right to freedom of expression and 
information in the existing guidance, but calls for additional concessions to further establish these 
principles in law. 


We value the existing code’s advice in relation to the gathering and retention of research and 
contact information. In particular, the code’s support of the retention of such material is an essential 
part of journalism, even where it is not being held for the purpose of publish a specific story. Finally, 
the code does well to support the industry by recognising the inherent public interest in journalism 
in all its forms, and applying a flexible approach to who may be the appropriate decision maker 
when applying the journalism exemption. 


However, improvements to the code could address the following additional issues: 


e Highlight how the media might tackle the issue of whether they are in a position to comply 
with the requirements of the Data Protection Act 2018 and when they might seek to rely on 
the journalism exemption. 

e = Identifying the controller/processor in relation to freelance journalists — the use of freelance 
journalists is widespread in relation to the processing of personal data for the special 
purposes. It would be useful if the ICO identifies the circumstances in which a freelancer is 
likely to be considered to be a controller in their own right and/or a joint controller or a 
processor, and the consequences that arise for the manner of contractual engagement in 
these circumstances, and for editorial and data protection policy. 

e Acknowledgement that the journalistic exemption can be relied on by third parties who wish 
to disclose personal data to the 'media’, including whistleblowers and other organisations, 
as well as utilizing the exemption at Schedule 1, paragraph 13 of the Data Protection Act 
2018. 


Q7 The journalism code will address changes in data protection law, including developments in 
relevant case law. Are there any particular changes to data protection law that you think we 
should focus on in the code? 


Reflecting the recent legislation requirements of GDPR and Data Protection Act 2018, it is important 
to recognise that the journalistic exemption found within the Data Protection Act 1998 will remain 
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relevant in the new Code, particularly in relation to potential complaints and claims (since the 
limitation period for data protection claims is 6 years). 


Accordingly, the code should reflect both the old and new regime or make clear that it only applies 
to future processing, as well as acknowledging that the requirements for processing under the 1998 
Act may be different and, in pre-dating the code, cannot be interpreted or assessed against its 
content. 


In light of the revised data protection regime, we call for the following amendments to the ICO Code 
to reflect the latest legislation: 


e Removal of the requirement from Article 85 GDPR and Schedule 2, Part 5, para.26(2)(a) Data 
Protection Act 2018 that processing must be "only" for the special purposes in order to fall 
within the scope of the journalism exemption. 

e Recognition of the expanded breadth of the journalism exemption, in relation to 
international data transfers (Schedule 2, Part 5, para.26(9)(d) Data Protection Act 2018) and 
the co-operation and consistency mechanism (Schedule 2, Part 5, para.26(9)(e) Data 
Protection Act 2018), as well as new data subject rights (as to which, see below) for 
example. 

e Recognition of the new provisions afforded to the new offences in the Data Protection Act 
2018 (i.e. s170(3) Data Protection Act 2018 and s171(4)(c) Data Protection Act 2018) for 
those processing for the special purposes. 

e How the exemption will apply to new data subject rights, specifically the right to rectification 
(Article 16, GDPR and ss46-47 Data Protection Act 2018), right to restriction of processing 
(Article 18, GDPR), the notification obligation in relation to the rectification restriction of 
processing (Article 19, GDPR), and the right to data portability (Article 20, GDPR). 


Furthermore, we raise concerns over the following inconsistencies: 


e The right to rectification (Article 16, GDPR, and ss46-47 Data Protection Act 2018) will 
generally be incompatible with journalism as it would require the amendment or removal of 
archived material. 


e As for the right to restriction of processing (Article 18, GDPR), we do not consider that it 
would be compatible with the special purposes to require magazine publishers to restrict 
processing in the sense of removing published material or ceasing journalistic investigations 
merely upon the receipt of a complaint, which may well make bare assertions as to breaches 
of data protection legislation. We regard that only if, upon consideration, a detailed 
complaint exposes grounds to believe that there has been a breach of data protection 
legislation should consideration be given to the restriction of processing or some alternative 
measure, such as the inclusion of a notice on an online publication to the effect that it is the 
subject of complaint. 


e The right to data portability (Article 20, GDPR) in the context of journalism, for example 
where the subject of an interview subsequently seeks to have the personal data they have 
provided passed on to a competitor, potentially in an effort to halt publication or avoid 
legitimate journalistic criticism, would both be incompatible with journalism and interfere 
with the intellectual property rights of the controller and others. 
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e Recognition of the explicit protection afforded to archive material, in particular at Recital 
(153) to the GDPR, which provides that "The processing of personal data solely for journalistic 
purposes, or for the purposes of academic, artistic or literary expression should be subject to 
derogations or exemptions from certain provisions of this Regulation if necessary to reconcile 
the right to the protection of personal data with the right to freedom of expression and 
information, as enshrined in Article 11 of the Charter. This should apply in particular to the 
processing of personal data in the audiovisual field and in news archives and press libraries". 
The application of data subject rights, for example the right of access and right to 
rectification, in relation to archives could be more clearly codified. As it stands, the right of 
access to archive material, which may include both published and unpublished material, 
particularly in relation to public figures, has the potential to be incompatible with the special 
purposes. 


Q8 Apart from recent changes to data protection law, are there any other developments that are 
having an impact on journalism that you think we should address in the code? 


The publication of the Cairncross Review this year highlighted some of the significant challenges 
facing the UK publishing industry, and for this reason we call for caution when implementing a new 
ICO regulatory regime that will put publishers under further regulatory and financial pressure from 
the ICO. 


In particular, economic pressures for magazine publishers has led to the development of editorial 
structures which are less hierarchical than traditional structures. It is therefore important that the 
ICO takes care to ensure that the code is sufficiently flexible to allow such models of editorial 
decision making, and to avoid stifling innovation. 


Resultantly, this means that prescriptive requirements for evidencing or recording reliance on the 
special purposes exemption is likely to be inappropriate and damaging. Furthermore, we raise 
concerns and call for caution in relation to guidance on responding to subject access requests, as this 
can impose a disproportionate burden on smaller editorial teams. Same strain is imposed when 
responding to the exercise of other rights of data subjects (including erasure, rectification and 
restriction). 


With a rising number of people using online platforms to find news online, the ICO could offer 
insight into how it will approach the enforcement of these rights, which appropriately respects the 
right to freedom of expression and information in relation to online platforms, who are playing an 
increasing role sharing the content and contributing to the fulfilment of public interest news. 


The rise in use of Artificial Intelligence (Al) as a means of generating journalistic content should be 
taken into consideration when adopting a new code, particularly, the extension of the journalism 
exemption to such content. 


Q9 Are there any case studies or journalism scenarios that you would like to see included in the 
journalism code? 


See MLA submission. 
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To strike the right balance in the new code, we highlight the following sections of the existing code 
that fail to accurately reflect the balance to be achieved between data protection law and the right 
to freedom of expression and information. 


Q10 Do you have any other suggestions for the journalism code? 


The existing guidance states that "Organisations will find it easier to rely on the exemption if they can 
show... appropriate record keeping for particularly controversial decisions". In a recent case in which 
a Monetary Penalty Notice was issued, the ICO appears to have adopted an approach whereby a 
failure to keep concurrent records of editorial decision making in the form of a specific document 
meant that the media organisation concerned was unable to rely on the journalism exemption. This 
not only goes further than what is suggested in the guidance, but is neither necessary nor 
proportionate and is thereby an inappropriate restriction on the right to freedom of expression and 
information. 


Secondly, the requirement of incompatibility is restated in different forms throughout the existing 
code, potentially detracting from and complicating its proper interpretation, which requires the data 
controller to consider “whether it would have been reasonably practicable to comply” while at the 
same time making the publication in question (Campbell v MGN Ltd [2003] QB 633, [136])". 


Related to this, the above issue is exacerbated by the ICO's approach, both in the guidance and in 
recent decisions, to the application of the incompatibility requirement. The guidance states that 
“even if a story is clearly in the public interest, if a journalist can reasonably research and present it 
in a way that complies with the standard provisions of the DPA, they must”. However, a recent 
decision in which a Monetary Penalty Notice was imposed, a similar approach was taken, and the 
ICO stated that "That compliance with the First Principle was compatible with the purpose of 
journalistic processing... is also to be inferred from the facts that... [THE DATA CONTROLLER] was 
able... to screen its intended documentary - to wide acclaim — without the use of any of the unlawful 
footage but by use of properly consented footage and interviews". 


Such an approach suggests that if an acceptable alternative output could be produced that it is not 
in accordance with the data controller's editorial objective, then the ICO will never uphold the 
journalism exemption, as it will never accept that compliance with the relevant requirements of data 
protection legislation is incompatible with journalism. 


At numerous points, the code fails to reflect that not only actual wrongdoing or incompetence is 
included, but also allegations of such conduct are capable of being the subject of a reasonable belief 
in public interest. This appears to be an unintended omission, but would benefit from explicit 
inclusion. 


When considering whether data subjects should be notified that their personal data is being 
processed, and at what point in time, the existing guidance states that data controllers "will need a 
valid reason" for not notifying the subject of a journalistic investigation that their data is being 
collected and that this "justification should reflect the privacy intrusion". Such an approach appears 
to suggest that in circumstances where information which is capable of attracting a strong privacy 
interest is proposed to be published, notification is more likely to be required. This fails to meet the 
requirements of the journalism exemption, and continues with an approach that has been 
specifically rejected by the European Court of Human Rights in Mosley v United Kingdom 
(48009/08), [2012] EMLR 1. 
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The PPA raises concerns about the ICO’s approach to the protection of confidential sources. The 
existing guidelines fail to properly reflect the existing law by suggesting that there may be 
(unspecified) circumstances in which it would be reasonable, and therefore mandatory, for a 
magazine publisher to reveal the identity of a confidential source in response to a right of access 
request, for example. Whereas Article 10 of the European Convention on Human Rights and s10 
Contempt of Court Act 1981 require that only where a court is satisfied that disclosure is necessary 
for certain specified purposes, specifically in the interests of justice or national security or for the 
prevention of disorder or crime, can a journalist be required to identify a journalistic source. 


Furthermore, on the subject of access rights, the ICO’s approach to the issue of incompatibility has, 
in practice, sought to separate principled objections to compliance from issues of proportionality of 
requests and impact on resources. The ICO has taken this approach despite the fact that these may 
well be inter-related issues which cannot be considered in isolation and at different stages of the 
compliance process, and the fact that their relevance is recognised in the existing guidance, which 
states that "the resource implications of compliance with a particular SAR (both financial and human) 
may be relevant factors". We therefore believe that issues of reasonableness and proportionality of 
a request should be given greater consideration in the new code, and form part of determining 
whether compliance is reasonably practicable with the special purposes. 


Finally, the scope of what constitutes a journalistic purpose in the existing code is narrow in scope, 
stating "the exemption cannot apply to anything that is not an integral part of the newsgathering 
and editorial process. For example, information created in response to a complaint about a particular 
story after publication is unlikely to be processed with a view to publication". This contradicts the 
Supreme Court's acceptance in the case of Sugar (Deceased) v BBC [2012] UKSC 4 that the purpose 
of journalism encapsulates the act of publishing or broadcasting together with "first, the collecting, 
writing and verifying of material for publication; second, the editing of the material, including its 
selection and arrangement, the provision of context for it and the determination of when and how it 
should be broadcast; and third, the maintenance and enhancement of the standards of the output by 
reviews of its quality, in terms in particular of accuracy, balance and completeness, and the 
supervision and training of journalists" (para.39). 


This in fact suggests that complaints material, which will in any event be relevant to the ongoing or 
further publication of journalistic material and the assessment of whether publication remains in the 
public interest, does fall within the scope of the exemption and should be recognised as such. 


The PPA calls for these inconsistencies to be resolved in the revised code. 


About you 


bei Q11 Are you answering these questions as? 


B A trade association? 
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Q12 How did you find out about this survey? 


iz) Other (via email) 


Q13 We may want to contact you about some of the points you have raised. If you are happy for 
us to do this please provide your email address: 


